PT-2008-5214 · Ultra · Ultra Office Control

Shinnai · Published 2008-09-02 · Updated 2024-02-14 · CVE-2008-3879

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ultra Office Control version 2.0.2008.801 and earlier

Description The issue allows remote attackers to force the download of arbitrary files onto a client system. This is achieved by using a URL in the first argument to the Open method, in conjunction with a full destination pathname in the first argument (SaveAsDocument argument) to the Save method.

Recommendations For Ultra Office Control version 2.0.2008.801 and earlier, consider disabling the Open and Save methods until a patch is available to prevent the forced download of arbitrary files. Restrict access to the Ultra.OfficeControl ActiveX control to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-3879

Affected Products

Ultra Office Control

References · 8

• 🔥 https://exploit-db.com/exploits/6319 · Exploit
• 🔥 http://shinnai.net/xplits/TXT_NPku7jFjRufaz85U6Lxn.html · Exploit
• http://secunia.com/advisories/31632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3879 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44750 · Note
• http://securityfocus.com/bid/30863 · Note
• http://securityreason.com/securityalert/4201 · Note
• http://shinnai.net/index.php?mod=02_Forum&group=Security&argument=Remote_performed_exploits&topic=1219827906.ff.php · Note